Hi,
if avifrate has a write protected IAT and your system trys to pageout a
page from the IAT, this page is reloaded with the original IAT from the
image. I've fixed this problem in my local source tree
(ntoskrnl\mm\section.c). I will commit the changes after some cleanup.
> (KERNEL32:process/create.c:380) BaseProcessStart: call exe
> start 4355dc
> Entered debugger on exception number 14.
>> Entered kernel debugger (type "help" for a list of commands)
>
Can you print the faulting address (cr2) at this point?
- Hartmut